IOActive

IOActive is a Seattle-based security research and consulting firm founded in 1998 out of a Def Con Capture the Flag-competing group of ethical hackers. Unlike most consultancies that primarily deliver standard penetration tests, IOActive has built its reputation on original, published vulnerability research into non-traditional and embedded systems: satellite communications terminals, ATMs, medical devices, industrial control systems, and automotive electronics. Researcher Barnaby Jack’s public "jackpotting" demonstration of ATM vulnerabilities and Ruben Santamarta’s research into exploitable flaws in SATCOM terminals are among the firm’s most widely covered findings, both independently reported well beyond IOActive’s own channels.

The company delivers full-stack penetration testing, hardware hacking, secure development lifecycle services, and program efficacy assessments to Global 1000 clients, and holds CREST accreditation for its penetration testing practice. It operates from offices in Seattle, London, Madrid, and Dubai and reports engagements in more than 30 countries, with roughly 150 employees and estimated annual revenue in the $15M range as a privately held, apparently self-funded firm.

IOActive’s differentiation is its research-driven brand: security teams and journalists alike treat an IOActive advisory on a car, satellite modem, or industrial controller as credible because the firm has a two-decade track record of publishing findings that get independently reproduced and covered by mainstream press, not just marketing collateral. That said, as a services firm its actual client engagement quality varies project to project in ways that public research output does not directly measure.